Credit card skimmers: how to spot and stop them

A credit card skimmer is an illegal device that criminals attach to or hide inside a payment terminal to copy card data. The FBI describes skimming as what happens when devices illegally installed on ATMs, point-of-sale (POS) terminals, or fuel pumps capture data or record cardholders' PINs. Thieves then use that data to make counterfeit cards.

Most skimming advice is written for shoppers. This guide is for the business that owns the terminal: how skimmers and shimmers get onto your devices, how to inspect for them in under a minute, what PCI DSS requirement 9 expects of you, and why chip and tap payments take most of the value out of a stolen card number. Rules and dates are current as of October 2026.

What is a credit card skimmer?

A skimmer is any hardware that reads card data or captures a PIN without the cardholder or the merchant knowing. The FTC's short version: skimmers are illegal card readers attached to payment terminals that grab data off a credit or debit card's magnetic stripe. Newer devices go after the chip slot and the keypad as well.

The names overlap in practice, and a single device can do more than one job. What matters for you is the pattern: something added, something loose, or something that doesn't match the terminal you bought.

How do skimmers get onto terminals, gas pumps, and ATMs?

Criminals pick devices that are easy to reach and rarely watched. The method changes with the hardware.

Countertop and handheld terminals

Store terminals are usually hit with overlays. The US Secret Service, which investigates skimming, says POS terminal skimmers are typically overlays that cover either the entire top exterior of the terminal, or just the keypad and EMV reader slot, and that criminals build plastic shells that look identical to the real terminal. Its 2025 public advisory adds that these overlays can capture stripe data, chip data, and every keypad entry, including a debit PIN.

Fitting an overlay takes seconds when a terminal sits unattended at a self-checkout or a quiet end of the counter. Swapping the whole terminal for a doctored one takes longer and usually needs a cover story, which is why PCI DSS asks staff to verify anyone who claims to be a repair technician (more on that below).

Gas pumps

Pumps are exposed because the reader sits inside a cabinet, often out of the attendant's sight. The FTC notes that many stations put security seals over the cabinet panel, and if the panel is opened, the label will read "void". The FBI's advice to drivers tells you which pumps thieves prefer: it suggests choosing a fuel pump closer to the store and in direct view of the attendant, because those are less likely to be targeted.

ATMs

ATM skimmers are built to blend in. The FBI says the devices planted on ATMs are usually undetectable by users, often a realistic-looking card reader placed over the factory-installed one, paired with a hidden camera or keypad overlay to catch the PIN. If you own an ATM in your store, it needs the same inspection routine as your terminals.

How do you inspect your terminals for skimmers?

Inspect every device at the start of each shift, and make it a 30-second habit rather than a project. The Secret Service tells consumers to look at the terminal's plastic edges and keypad for signs of tampering and to gently pull up on the corners of the terminal or the keypad's privacy shroud. Your staff can do the same thing, more thoroughly, because they know what the device looked like yesterday.

1. Count your devices and match each serial number to your list. A swapped terminal is easier to catch with a serial number than by eye.
2. Look at the card slot, chip slot, and keypad from the side. Overlays add thickness, and edges that don't line up are a warning.
3. Pull gently on the card reader, keypad, and corners. Nothing on a terminal should lift, slide, or wobble.
4. Check the security seals and screws. Broken seals, scratches around screws, or new tape all deserve a closer look.
5. Insert a test card or your own card. A chip slot that suddenly feels tight can mean a shimmer is sitting inside it.
6. Check cables and the back of the device for anything plugged in that you didn't install.
7. Log the check: date, time, initials. If something turns up later, you'll know the window it appeared in.

Some merchants also use high-visibility security seals on the sides of terminals so an overlay is easier to spot. Cheap seals work best when they're numbered and the numbers go on your device list.

Take a convenience store in Houston with two counter terminals and four pumps. At 30 seconds a device, the morning check of all six takes about three minutes, and a photo of each terminal on day one gives staff a reference image for "what normal looks like."

What does PCI DSS requirement 9 say about protecting payment terminals?

PCI DSS requirement 9 covers physical access to cardholder data, and its section on point-of-interaction (POI) devices is the part that deals with skimming. PCI SSC's FAQ on that section lists three duties: keep an up-to-date list of the devices, inspect them for tampering and unauthorized substitution, and train staff. The table follows requirement 9.5.1 as the PCI DSS v4.0 SAQ B words it.

The training piece is the one people skip, and it's the one that stops the "technician" who shows up to replace your terminal. PCI's wording includes verifying the identity of anyone claiming to be repair or maintenance staff before they touch a device, and making sure devices aren't installed, replaced, or returned without verification. A simple rule covers most of it: no one swaps a terminal unless you scheduled it with your provider and can confirm the visit by phone.

Where these requirements apply depends on your SAQ. Our guide to what PCI compliance is explains how to find yours, and Clearo offers PCI compliance support for small businesses if you want a second pair of eyes on it.

How do EMV chip and contactless payments reduce skimming risk?

They make stolen data much less useful. A chip creates a one-time security code for each transaction, so even when a shimmer copies data from the chip, the copy can't produce the fresh code a chip terminal expects at the next store. A magnetic stripe hands over the same data every time, which is why stripe data is what counterfeit cards are made from.

The numbers backed this up after the US switch. Visa reported that merchants who completed the chip upgrade saw counterfeit fraud dollars drop 80% in the quarter ended September 2018, compared with the same quarter of 2015.

Contactless goes a step further for skimming in particular. Visa says contactless cards carry the same security as contact chip cards, and a tapped card never enters the slot where an overlay or shimmer waits. That's why the FBI tells drivers to tap instead of swiping or inserting at the pump when they can. A keypad overlay can still catch a PIN, so taps don't replace inspections. Our guide to whether tap to pay is safer covers the trade-offs.

Gas stations had a later deadline than stores. Visa moved its liability shift for automated fuel dispensers to April 17, 2021, and Mastercard moved its date to April 16, 2021. A pump that still reads only the stripe leaves counterfeit losses on the station's side. Our automotive page covers payment setups for fuel and auto businesses, and what EMV is explains how the liability shift works.

The stripe itself is on its way out. Mastercard says no Mastercard credit or debit card will carry a magnetic stripe by 2033. Until then, every swipe you accept is a swipe a skimmer can copy.

What should you do if you find a skimmer?

Treat it as a possible data compromise, not a maintenance problem. Move quickly, but don't destroy evidence.

1. Stop using the device. Put a sign on it or unplug it, and switch customers to another terminal.
2. Don't pry the skimmer off. Photograph it, leave it in place if you can, and keep staff away from it.
3. Call your payment provider and local police. Your provider can tell you what it needs and which network rules now apply.
4. Check every other device you own against your list. Where there's one, look for more.
5. Note when the device last passed inspection, so investigators know the window of exposure.
6. Keep records of everything you did and when.

Speed matters for the network side, too. Visa's compromise rules require an incident to be reported to Visa and the acquirer within three calendar days, so your provider will want to hear from you the same day.

Can online stores be skimmed too?

Yes, though there's no hardware involved. Online skimming uses malicious code on a checkout page to copy card details as customers type them, including the CVV. PCI SSC now asks merchants that embed a provider's payment form to confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems.

The best defense is keeping card data off your pages entirely: a hosted payment page or provider-hosted fields, and stored cards held as tokens rather than numbers. Our guide to payment tokenization explains how that works, and Clearo's online payments include hosted checkout.

Common mistakes that let skimmers in

These habits make a skimmer's job easier:

• No device list, so a swapped terminal looks the same as the old one.
• Terminals left unattended at a self-checkout or a quiet counter, with no one assigned to check them.
• Letting a "technician" service or replace a terminal without confirming the visit with your provider.
• Accepting swipes by default when the terminal can read chips and taps.
• Keeping old, unsupported terminals in service because they still power on.
• Treating inspections as a quarterly chore instead of a shift-start habit.

When is it time to replace a terminal?

Replace it when it can't read both chip and contactless, when your provider no longer supports it, or when its casing is cracked or worn enough that tampering would be hard to spot. Older hardware isn't automatically unsafe, but a device that pushes customers to swipe gives skimmers the stripe data they want. If you're shopping, our guide to credit card machines for small business lists what to look for, and our POS terminals read chip, tap, and swipe.

For businesses that take payments away from a counter, such as a food truck in Indianapolis, a phone or small reader that stays in the owner's hand is a hard target for an overlay. Clearo's mobile payments include tap to pay and mobile card readers. These skimming rules come from the card networks and PCI SSC, so they apply the same way across the United States.

Next step

If your terminals are old enough that you're not sure what they support, or you'd like help setting up a device list and inspection log, talk to us. Send a recent statement for a free statement review and we'll flag swiped and keyed sales that point to a terminal problem, or contact us to go through your hardware with a rep.